Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 5 of 9
- Web App Security
Check session changes at login and elevation
Build a session-transition test record for login, privilege elevation, and logout. Check that an old session identifier cannot inherit new authority.
- Dependency security
Prioritize a KEV match with local deployment evidence
Connect a CISA known-exploitation record to the exact advisory and deployed component. Record exposure, uncertainty, mitigation, and accountable remediation.
- Web App Security
Review CSRF protection for browser form actions
Map cookie-authenticated mutations to their CSRF controls. Test missing tokens, untrusted origins, and legitimate forms without changing real customer data.
- Credential & Access Lifecycle
Protect CI Deployment Secrets
Map which CI workflows can read deployment secrets, then test untrusted pull requests and least-privilege release jobs.
- Credential & Access Lifecycle
Protect Credential Backups
Map secret copies in backups and restore paths, then test access, retention, and use of retired credentials after recovery.
- AI & MCP Permissions
Protect MCP Elicitation Inputs
Control the fields and URLs an MCP server may request from a user, with safe denial and phishing checks.
- Tenant Isolation & API Authorization
Protect Tenant Detail Links
Ensure direct record links enforce current membership, even when a user saved the URL earlier.
- Tenant Isolation & API Authorization
Protect Tenant Pagination Cursors
Bind a pagination cursor to the tenant, filter, and permission context that issued it.
- Dependency security
Publish a Security Reporting Policy
Give researchers a clear private contact route, scope, response expectations, and a machine-readable security.txt file.
- Web App Security
Keep uploads unavailable until checks finish
Define pending, accepted, rejected, and expired upload states. Bind check results to immutable bytes and test publication races and worker failures.
- Web App Security
Set login attempt limits without broad lockouts
Design account and network limits with a recovery path. Test shared-network users, distributed attempts, reset behavior, and bounded operational failures.
- Credential & Access Lifecycle
Reconcile Provider Access After Revocation
Compare local access records with provider grants after revocation and resolve every stale, missing, or unexpected permission.
- AI & MCP Permissions
Record Per-Client MCP Consent
Bind MCP consent to the registered client, resource, user, and exact scopes; test changed-client and revocation cases.
- Dependency security
Record a VEX decision for an exact product release
Connect a vulnerability applicability decision to a specific product, evidence, reviewer, and recheck trigger. Keep uncertainty visible in VEX records.
- Credential & Access Lifecycle
Redact Secrets From Build Logs
Test CI logs and failure traces with synthetic markers so deployment credentials and derived values do not appear in output.
- Tenant Isolation & API Authorization
Redact Tenant Data in Logs
Define which tenant fields may enter shared logs and how to verify redaction.
- Credential & Access Lifecycle
Reduce Third-Party OAuth Scopes
Map each third-party OAuth scope to a live feature, remove unused grants, and plan reconsent for necessary changes.
- Dependency security
Keep release artifacts and SBOM revisions aligned
Decide when to regenerate an SBOM and when to update vulnerability analysis instead. Preserve artifact mappings, previous inventories, and correction history.
- Tenant Isolation & API Authorization
Reject Untrusted Tenant Headers
Derive tenant context from verified membership instead of trusting a caller-supplied header.
- Web App Security
Define webhook replay and delivery-age checks
Separate signature freshness from duplicate event processing. Build tests for stale signed deliveries, retries, clock skew, and endpoint-specific replay policy.
- Review preparation
Turn a security finding into acceptance tests
Write regression tests that prove the intended control works. Cover denied access, legitimate use, and side effects without preserving sensitive evidence.
- Tenant Isolation & API Authorization
Remove Sensitive API Error Details
Define error fields that help clients without exposing tenant data or internal secrets.
- Credential & Access Lifecycle
Remove Stale Admin Grants
Find administrator grants with no current job need, remove them at the provider, and prove normal access still works.
- Dependency security
Replace End-of-Life Runtimes
Plan an owned runtime upgrade by finding deployed versions, blocked packages, compatibility risks, and rollback evidence.